Symptoms:

   

   A VPG is configured to run a pre-recovery script as part of the start of a test failover, live failover or move.

An alert is generated after attempting and failing to start a test failover, live failover or move:
Protection group failover before commit. Failed: Protection group [VPG Name] failover before commit failed due to pre script failure.    

 

Cause:

   

   1. The account that is configured to run the 'ZertoZVM' service does not have the privileges needed to run the script.
2. The PowerShell Execution Policy on the ZVM is set to 'Restricted' which blocks a PowerShell pre-recovery script from executing or is set to 'AllSigned' which blocks an unsigned PowerShell pre-recovery script from executing. The default PowerShell Execution Policy for Windows Server is 'RemoteSigned'.

For more information on the RemoteSigned execution policy, please refer to:
https://devblogs.microsoft.com/powershell/how-does-the-remotesigned-execution-policy-work/    

 

Solution:

       

  1. Log onto the ZVM server with the same account configured to run the 'ZertoZVM' service and manually run the pre-recovery script. If this fails due to a privilege error then modify the account privileges to allow the script to run and then repeat this test.
  2. Log onto the ZVM server and run the PowerShell cmdlet Get-ExecutionPolicy to view the PowerShell Execution Policy. If the policy is set to 'Restricted' then run the PowerShell cmdlet Set-ExecutionPolicy to change the policy to allow the pre-recovery script to run. If the policy is set to 'AllSigned' then run the PowerShell cmdlet Set-ExecutionPolicy to change the policy to allow the pre-recovery script to run or verify the script is signed by a trusted publisher.

Workaround: If the fixes above are not immediately possible, then edit the VPG, remove the pre-recovery script settings and re-run the test failover, live failover or move. Once a fix is applied then the pre-recovery script settings can be added back to the VPG.

For more information on the PowerShell cmdlets mentioned above, please refer to:
https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-executionpolicy?view=powershell-6
https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-6